harness-eval

SUSPICIOUS. The benchmarking purpose is mostly coherent, but the skill includes explicit instructions to circumvent `.claude/` sensitive-path permission checks using `/tmp` and Bash because the copy is 'not audited'. That concealment/evasion behavior is disproportionate to a reporting skill and materially raises risk even without obvious credential theft or malware payloads.